IT49009: SSL CONNECTIONS ARE NOT SUPPORTED WHEN USING THE OPENTELEMETRY HTTP EXPORTER.

APAR status

• Closed as program error.

Error description

• If an https:// URL is specified for exporterOtlpHttpUrl, the
  OpenTelemetry HTTP client may attempt to establish an SSL
  connection using the systems default OpenSSL certificates. At
  present, the HTTP exporter does not support SSL connections or
  configuration options for custom trust stores or key stores.
  Therefore, the SSL handshake may fail when connecting to the
  OpenTelemetry endpoint. This can result in an SSL-related
  connection error.
  BIP9570E: OpenTelemetry error: '[OTLP HTTP Client] Session
  state: connection failed.SSL certificate problem: unable to get
  local issuer certificate' - '[]'.
  This Apar is raised to add the support for SSL/TLS when using
  OpenTelemetry HTTP exporter.
  

Local fix

• For secure communication, we recommend using the gRPC exporter,
  which fully supports SSL/TLS with configurable key and trust
  stores.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of App Connect Enterprise v12 and v13 using SSL with
  the OpenTelemetry HTTP Exporter.
  
  
  Platforms affected:
  WinX64, LinuxX64, LinuxPPCLE64, LinuxZ64, AIX
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When an https:// URL is configured for exporterOtlpHttpUrl, the
  OpenTelemetry HTTP exporter attempts to establish an SSL/TLS
  connection using the systems default OpenSSL certificate store.
  However, the current implementation of the HTTP exporter does
  not support SSL/TLS connections.
  As a result, SSL handshakes may
  fail when connecting to a secured OpenTelemetry endpoint with
  the following error:
  
  BIP9570E: OpenTelemetry error: '[OTLP HTTP
  Client] Session state: connection failed. SSL certificate
  problem: unable to get local issuer certificate'
  

Problem conclusion

• The product has been updated so that the OpenTelemetry HTTP
  exporter now supports SSL/TLS.
  To enable this capability,
  configure the following properties in server.conf.yaml under
  OpenTelemetryManager:
  
  OpenTelemetryManager:
  
  exporterOtlpHttpUr
  l: ''                              # The HTTP/JSON URL to which
  the OpenTelemetry span data is sent.
  # For example,
  'http/https://<hostname>:<port>/v1/traces'.
  openTelemetryTrustst
  oreType: ''                      # Type of OpenTelemetry
  truststore. Valid values are PKCS12, PEM, or
  JKS.
  openTelemetryTruststoreFile: ''                      #
  Location of the OpenTelemetry
  truststore.
  openTelemetryTruststorePass: 'truststore::password'
   # Credential or resource alias containing the truststore
  password.
  openTelemetryTrustAlias: ''                          #
  Alias of the trust certificate in the PKCS12 or JKS
  truststore.
  
  Configure openTelemetryTruststoreFile,
  openTelemetryTruststoreType and openTelemetryTruststorePass in
  server.conf.yaml according to the security and certificate
  requirements.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version   Maintenance Level
  v12.0      12.0.12.24
  v13.0      13.0.7.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0560

Applicable component levels